npm AI-agent policy reports, with evidence.

Direct source inspection confirms the policy-blocking behavior in the npm lifecycle hook. The explicit setup command does not mitigate the separate unconditional postinstall mutation.

The lifecycle hook performs a concrete, persistent write to ~/.claude/skills rather than merely printing setup guidance. This meets the blocking policy for unconsented postinstall mutatio...

Source inspection confirms an unconsented postinstall write into foreign AI-agent control paths. The absence of network or credential theft narrows the behavior but does not remove the pr...

This is a concrete malicious chain, not merely a bootstrapper: it installs broad agent instructions and executes an unpinned remote native payload. Lack of an npm lifecycle hook does not...

Source confirms concrete postinstall mutation of ~/.claude and ~/.codex, including Codex's default child-agent selection. That meets the block boundary for unconsented install-time mutati...

The unconditional postinstall writes to ~/.claude, which is a broad foreign AI-agent control surface. Per policy this concrete unconsented mutation warrants blocking even though the defau...

This is a concrete unconsented postinstall write to a broad AI-agent control surface. Runtime authentication and network features do not mitigate that install-time persistence.

The source confirms an unconsented postinstall mutation chain affecting foreign AI-agent control surfaces. This meets the install-control-surface block policy despite no observed exfiltra...

This is concrete, unconsented postinstall mutation of a foreign AI-agent control surface, with persistent automatic execution. The conditional existence check does not make the configurat...

The source directly implements cross-vendor AI-agent configuration mutation during postinstall, which meets the blocking policy regardless of the absence of visible exfiltration in the la...

This is a concrete postinstall mutation of foreign, broad AI-agent control surfaces. The absence of network exfiltration does not mitigate the unconsented persistent instruction installat...

Source inspection confirms the critical behavior rather than relying on scanner labels. The automatic global agent-control mutation and unpinned future executable meet the block policy.

This is concrete install-time mutation of foreign AI-agent control files, not merely interactive first-party setup. The hidden quiet path also bootstraps and executes remote code.

The install-time mutation targets a foreign, broad AI-agent control surface and is unconsented. Managed-target safeguards do not remove the initial automatic injection.

The postinstall hook performs a concrete, persistent write outside its own package into a dependency's OAuth UI. Under the install-control-surface policy, this warrants blocking despite t...

Although the bundled skill is documented and appears qgrid-specific, the postinstall hook automatically replaces foreign project and user-wide agent skill locations. That concrete install...

Source inspection confirms an unconsented postinstall modifies broad, foreign AI-agent configuration and installs persistent event hooks/extensions. This meets the install-control-surface...

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, matching the block boundary. The lack of an install-time network call does not mitigate th...

The confirmed postinstall path automatically installs package-controlled agent instructions into multiple third-party/global agent directories. This meets the block policy for unconsented...

The install hook performs unconsented mutation of foreign AI-agent control files and consumer build configuration. This meets the policy boundary for a publish block despite no observed n...

The install-time, default cross-agent mutation meets the firewall block policy even though no exfiltration endpoint was confirmed. The documented behavior and installer source directly su...